CVE-2016-4483: High severity libxml2-devel vulnerability
A vulnerability was found in libxml2. Parsing a maliciously crafted xml file could cause the application to crash if recover mode is used.
References:
http://seclists.org/oss-sec/2016/q2/195
Other sources
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4483?
CVE-2016-4483 is considered to have a moderate severity level due to the potential for application crashes when parsing malicious XML files.
How do I fix CVE-2016-4483?
To fix CVE-2016-4483, you should upgrade to libxml2 version 2.9.4 or later.
Which versions of libxml2 are affected by CVE-2016-4483?
Versions of libxml2 prior to 2.9.4, including 2.9.3 and below, are affected by CVE-2016-4483.
What operations are impacted by CVE-2016-4483?
CVE-2016-4483 can cause applications to crash when they are in recovery mode while parsing a crafted XML file.
Is CVE-2016-4483 relevant for all operating systems?
CVE-2016-4483 is primarily relevant to systems using versions of libxml2, such as Debian and Oracle Solaris installations.